System and control method thereof

Abstract

To provide a system that aims to migrate from a FIPS mode compliant device to a FIPS compliant device by managing authentication information that can be used by a new authentication method without bothering the user to reset the authentication information. and its control method.SOLUTION: An image forming apparatus which is an information processing apparatus that executes authentication processing using authentication information received from a terminal includes: a first authentication means that encrypts first authentication information received from the terminal into second authentication information and performs a first authentication process using second authentication information and the authentication information managed in advance; and a second authentication means to perform a second authentication process different from the first authentication process, and manages the first authentication information so that it can be used by the second authentication means when the second authentication information is authenticated by the first authentication means.SELECTED DRAWING: Figure 12

Description

Technical Field

[0001] The present invention relates to a system for user authentication and a control method thereof.

Background Art

[0002] When a PC application (hereinafter referred to as a PC app) for remotely operating an image forming apparatus such as an MFP accesses the image forming apparatus, administrator authentication is involved. Here, as examples of operations, various things such as installing an app for expanding the functions of the image forming apparatus or acquiring image forming apparatus information can be considered.

[0003] In administrator authentication, the user is made to input a password (hereinafter referred to as PW) for accessing the image forming apparatus on the PC app. The authentication system of the image forming apparatus that has received the password compares it with the password it has stored and determines whether they match to determine authentication OK / NG. Specifically, when the password stored by this authentication system is hashed by a hash algorithm such as the MD5 hash method (hereinafter, the result of MD5 hash processing of PW is PWMD5) and stored, the PC app further MD5 hashes the result of adding the challenge value ch to PWMD5 (hereinafter, (PWMD5 + ch) × MD5) and transmits it to the image forming apparatus. The authentication system of the image forming apparatus generates (PWMD5 + ch) × MD5 from the password PWMD5 it stores, compares it with (PWMD5 + ch) × MD5 received from the PC app, and determines authentication OK / NG. Patent Document 1 discloses a network device management apparatus that calculates a hash value using the MD5 function for the received password and performs comparison and authentication.

[0004] On the other hand, PCs and image forming machines now have a feature called FIPS (Federal Information Processing Standards) mode. This is a set of government standards that define how certain things, such as encryption algorithms, are used by the government. More specifically, MD5 hashing and other algorithms are designated as compromised algorithms in FIPS, and these algorithms cannot be used on devices with FIPS mode enabled. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2009-93342 [Overview of the project] [Problems that the invention aims to solve]

[0006] When a user updates their existing device to be FIPS-compliant by updating the firmware, the following problems arise (for the sake of explanation, the encryption algorithm prohibited by FIPS will be referred to as the "first encryption method"). For devices that have managed authentication information encrypted with the first encryption method and have performed authentication using that managed information, the managed authentication information remains the same even after FIPS mode compliance. In other words, since the device continues to hold authentication information encrypted with the first encryption method, authentication cannot be performed unless the authentication information sent from a terminal such as a PC is encrypted with the first encryption method, which is inconsistent with the fact that the first encryption method is prohibited by FIPS mode. The device also cannot decrypt authentication information encrypted with the first encryption method.

[0007] Therefore, one possible approach is to ask users to reconfigure their credentials in order to refresh the authentication information stored on their devices. However, if there are multiple devices affected, the reconfiguration process must be performed for each device.

[0008] This invention has been made in view of the above problems, and aims to enable the transition from a FIPS-compliant device to a FIPS-compliant device by managing authentication information that can be used with a new authentication method, without requiring users to go through the trouble of resetting their authentication information. [Means for solving the problem]

[0009] An information processing device that performs authentication processing using authentication information received from a terminal, A first authentication means that encrypts the first authentication information received from the terminal into a second authentication information, and performs a first authentication process using the second authentication information and pre-managed authentication information, It includes a second authentication means that performs a second authentication process different from the first authentication process, If the second authentication information is authenticated by the first authentication means, The first authentication information is managed so that it can be used by the second authentication means. death, The information processing device, which has FIPS mode enabled and has acquired the first authentication information after the second authentication information has been authenticated by the first authentication means, Authentication information received from the terminal is authenticated by the second authentication means without using the first authentication means. An information processing device characterized by the following: [Effects of the Invention]

[0010] By managing authentication information that can be used with a new authentication method without requiring users to go through the trouble of reconfiguring their authentication credentials, it is possible to migrate from a FIPS-mode compliant device to a FIPS-compliant device. [Brief explanation of the drawing]

[0011] [Figure 1] This is a hardware configuration diagram of an image forming apparatus. [Figure 2] This is a software module hierarchy diagram for an image forming apparatus. [Figure 3] This is a software module hierarchy diagram for a device operation application. [Figure 4]Shows the UI when the device operation application operates the image forming apparatus. [Figure 5] It is a sequence diagram when the device operation application inquires the image forming apparatus for authentication. [Figure 6] It is a block diagram showing the authentication process in the combination of the old application and the old image forming apparatus. [Figure 7] It is a block diagram showing the authentication process in the combination of the new application and the new device (old password method). [Figure 8] It is a block diagram showing the authentication process in the combination of the new application and the new device (new password method). [Figure 9] It is a block diagram showing the authentication process in the combination of the old application and the new device (old password method). [Figure 10] It is a block diagram showing the authentication process in the combination of the old application and the new device (new password method). [Figure 11a] It is a flowchart showing the determination process of whether the authentication of either the new or old application has been completed by the device operation IF service 203 that has received the password. [Figure 11b] It is a flowchart showing the authentication process in the authentication processing unit 204 when the device operation IF service 203 determines in Fig. 11a that it has received the password from the new application. [Figure 11c] It is a flowchart showing the authentication process in the authentication processing unit 204 when the device operation IF service 203 determines in Fig. 11a that it has received the password from the old application. [Figure 12] It is a block diagram showing the authentication availability of the entire system when upgrading the version from the old device to the new device. [Figure 13] It is a system configuration diagram including at least the image forming apparatus 130 and the terminal 140.

Embodiments for Carrying Out the Invention

[0012] Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings.

Example

[0013] Hereinafter, a conventional FIPS non-compliant application will be referred to as an old application, a FIPS compliant application will be referred to as a new application, a conventional FIPS non-compliant image forming apparatus will be referred to as an old device, and a FIPS compliant image forming apparatus will be referred to as a new device.

[0014] In Example 1, in the case of upgrading from an old device to a new device, the basic process of migrating the password encryption method to a new encryption method in combination with a new application and making it FIPS compliant will be described.

[0015] In the following examples as well, a FIPS non-compliant application will be referred to as an old application, a FIPS compliant application will be referred to as a new application, a FIPS non-compliant image forming apparatus will be referred to as an old device, and a FIPS compliant image forming apparatus will be referred to as a new device. Also, for the sake of explanation, the image forming apparatus 130 will be taken as an example to explain the old device and the new device. However, the old device and the new device are not limited to the image forming apparatus 130, and any information processing apparatus having an authentication function may be used.

[0016] FIG. 13 is a diagram showing a system including at least the image forming apparatus 130 and the terminal 140. It is assumed that both are connected by the LAN 116.

[0017] FIG. 1 is a hardware configuration diagram of an image forming apparatus 130 having a printing function, a scanning function, a network communication function, and the like.

[0018] The image forming apparatus 130 is electrically connected to a scanner unit 113 and a printer unit 114, and is also connected to an external device via the LAN 116. The CPU 101 comprehensively controls access to various connected hardware based on a control program stored in the ROM 102, and also comprehensively controls various processes performed inside the controller.

[0019] ROM102 is a read-only non-volatile memory area that stores the boot program and firmware of the image forming apparatus 130. RAM103 is the system work memory for the operation of the CPU 101 and is a memory for temporarily storing various data. RAM103 is composed of FRAM (registered trademark) and SRAM that can retain stored contents even after the power is turned off, and DRAM whose stored contents are erased after the power is turned off. HDD104 is a non-volatile memory area that stores system bundles and the like. The firmware of the image forming apparatus is stored in HDD104.

[0020] The control unit I / F 105 is an interface unit that connects the system bus 119 and the control unit 118. Specifically, it receives and displays data to be displayed on the control unit 118 from the system bus 119, and also outputs input information from the control unit 118 to the system bus 119. User instructions and information presentation to the image forming apparatus 130 are performed via the control unit 118.

[0021] Network I / F106 connects to LAN116, WAN117, and system bus 119, and performs input and output of information to and from the outside world.

[0022] The scanner interface 108 corrects, processes, and edits the image data received from the scanner unit 113. The image forming unit 109 performs image orientation conversion, image compression, and decompression. The printer interface 110 receives the image data sent from the image forming unit 109 and prints it using the printer unit 114 after image formation.

[0023] Figure 2 is a software module hierarchy diagram 200 of the image forming apparatus 130 related to the present invention. Each software shown in Figure 2 and subsequent figures is stored in ROM 102 or HDD 104 and executed by CPU 101. Various information used during execution is stored in RAM 103 or HDD 104 for information exchange between software functions. Furthermore, communication with external devices is performed using network I / F 106. Similarly, in the case of a terminal such as a PC with the device operation application 300 (described later) installed, it will have an operation unit, operation unit I / F, network I / F, CPU, RAM, ROM, and HDD, just like the image forming apparatus 130. Since the various functions are the same as in the case of the image forming apparatus 130, their explanation will be omitted.

[0024] Next, the software of the image forming apparatus 130 will be described. The image forming apparatus 130 has an operating system (OS) platform 201. The various modules 202 to 209 described later are assumed to be implemented on the OS 201.

[0025] UI202 is a user interface module that acts as an intermediary between the image forming apparatus 130 and the user when the user performs various operations and settings on the image forming apparatus 130. This module, in accordance with the operator's actions, transfers input information to various modules to request processing or change data settings.

[0026] The device operation IF service 203 is an interface that receives operation instructions for the image forming apparatus 130 from a terminal such as a PC. The device operation IF service 203 includes a challenge value acquisition API for obtaining the challenge value necessary for the authentication process described later. Other operation instructions include instructions for installing plugin applications to extend the functionality of the image forming apparatus 130 and instructions for obtaining configuration information of the image forming apparatus 130.

[0027] The information received by the device operation IF service 203 from the terminal includes not only these operation instructions but also authentication information such as passwords and user IDs. The content of the information used as authentication information differs depending on whether the image forming apparatus 130 is an old device or a new device. If it is an old device, the hash value of the password received from the terminal (a hash value calculated using the MD5 hashing method) is combined with a challenge value, and this value is further hashed using the MD5 hashing method, resulting in the value "(PWMD5+ch)×MD5" which is used as authentication information for verification. On the other hand, if it is a new device, the value obtained from the terminal plus a challenge value (hereinafter referred to as "PW+ch") is used as authentication information for verification. In other words, the authentication information to be verified differs between old and new devices, and the authentication process differs.

[0028] For the sake of explanation, this embodiment assumes that the encryption algorithm used in the old device was the MD5 hash method. However, it is not limited to the MD5 hash method, as any encryption algorithm prohibited by FIPS can be used.

[0029] Returning to the explanation of Figure 2, the authentication information received by the device operation IF service 203 is passed to the authentication processing unit 204. The authentication processing unit 204 compares the authentication information received from the terminal with the authentication information held in the password storage unit 205. If the comparison results in a match, it determines that the authentication process was successful and returns the result to the device operation IF service 203.

[0030] If the image forming apparatus 130 is an older device, the password storage unit 205 saves the MD5 hash of the password to a file using TPM encryption. Hereinafter, this encryption method will be referred to as the old password method. On the other hand, if the image forming apparatus 130 is a new device, the password storage unit 205 saves the password itself to a file using TPM encryption. Hereinafter, this encryption method will be referred to as the new encryption method. Just as the old encryption method is explained using the MD5 hash method as an example, the TPM encryption method is only one example of the new encryption method, and is not limited to the TPM encryption method, as any encryption method permitted for use under FIPS is acceptable.

[0031] A TPM (Trusted Platform Module) is an IC chip or module mounted on a circuit board, also known as a "security chip." A TPM has functions such as public-key cryptography (RSA) calculations and key generation, SHA-1 hash value calculation, random number generation, and digital signature generation. Within this chip, secure encryption and decryption, digital signature generation and verification, and encryption key management can all be performed.

[0032] The password file does not exist when the image forming apparatus 130 is first started, so it is created with default values. The password can then be changed by the user. If the user starts using the new device rather than upgrading from an old device, authentication information such as the password will be created from the beginning using the new encryption method.

[0033] The FIPS mode management unit 206 is a module that manages whether the FIPS mode of the image forming apparatus 130 is enabled (on or off). The FIPS mode of the image forming apparatus 130 can be switched on or off using the UI 202. The FIPS mode can be switched on the UI 202 by logging into the image forming apparatus 130 by an administrator or by a service technician.

[0034] The FIPS cryptographic provider 207 is a module that performs encryption processing when the authentication processing unit 204 performs encryption processing such as hash generation. The FIPS cryptographic provider 207 returns an error to the authentication processing unit 204 when FIPS mode is enabled (FIPS mode is on) and the authentication processing unit 204 requests a compromise algorithm such as MD5. On the other hand, when FIPS mode is off, the FIPS cryptographic provider 207 does not return an error even if the authentication processing unit 204 requests a compromise algorithm such as MD5, and compromise algorithms such as MD5 hash generation become available. In contrast, the general cryptographic provider 208 is a provider that can perform encryption processing, including MD5 hash generation, regardless of whether the FIPS mode is on or off by the FIPS mode management unit 206.

[0035] Here, we will explain the various types of providers. A cryptographic provider that can only use FIPS-compliant algorithms is defined as a FIPS cryptographic provider. That is, a FIPS cryptographic provider determines whether the current mode is FIPS mode, and if it is FIPS mode, it is designed so that MD5 hashing cannot be used. On the other hand, a provider without algorithm restrictions is defined as a general cryptographic provider. That is, a general cryptographic provider can use MD5 hashing regardless of FIPS mode. "Making terminal 140 and image forming apparatus 130 FIPS compliant" is equivalent to replacing the providers of the various devices with FIPS cryptographic providers.

[0036] The various operation processing units 209 perform the instructed operations if authentication is successful in the authentication processing unit 204. The device operation IF service 203 requests the various operation processing units 209 to perform the operations if the authentication process is successful.

[0037] Figure 3 illustrates the software hierarchy of the device operation application 300 installed on the terminal. UI301 is a user interface module that displays the UI when the user performs various operations on the device operation application. Depending on the user's operation, the UI may request the user to enter authentication information (such as a password). An example of the UI in such cases will be described later in Figure 4.

[0038] The operation instruction generation unit 302 is a module that generates commands to be instructed according to the content instructed by the UI 301. If authentication processing is instructed, it not only generates the authentication processing command but also encrypts the authentication information entered in the UI 301. Specifically, if the device operation application 300 is an old application, it generates authentication information (PWMD5+ch)×MD5 based on the entered password. On the other hand, if it is a new application, it generates authentication information PW+ch based on the entered password. However, if the new application is designed to also support old devices, and the generation of this authentication information fails, it may generate (PWMD5+ch)×MD5 again and retry the authentication processing to the image forming apparatus 130.

[0039] The operation instruction transmission unit 303 transmits the API provided by the device operation IF service 203 corresponding to the instruction, along with the authentication information generated by the operation instruction transmission unit 302. For example, if the type of instruction is "device information acquisition" to obtain setting information for the image forming apparatus 130, the GetDeviceInfo API corresponding to device information acquisition is called along with the authentication information.

[0040] The FIPS mode management unit 304 is a module that manages whether the terminal is in FIPS mode. In the case of Windows (trademark registered), the FIPS mode management unit 304 resides on the OS. In Windows, FIPS mode can be switched on or off through Windows settings.

[0041] The FIPS cryptographic provider 305 is a module that performs cryptographic processing such as hash generation. When the operation instruction generation unit 302 requests a compromise algorithm such as MD5 while the FIPS mode management unit 304 indicates that FIPS mode is on, the FIPS cryptographic provider 305 responds with an error. On the other hand, when the FIPS mode management unit 304 indicates that FIPS mode is off, processing using compromise algorithms such as MD5 hash generation becomes possible. The general cryptographic provider 306 is a provider that can perform cryptographic processing, including MD5 hash generation, regardless of whether the FIPS mode management unit 304 is on or off.

[0042] Figure 4 shows an example of the UI used when the device operation application UI301 operates the image forming apparatus 130.

[0043] Password input 401 is an item for entering the password required when operating the image forming apparatus 130 with the device operation application 300.

[0044] When a password is entered in the password input field 401 and the acquisition button 402 is selected, an authentication process using the entered password 401 is executed, and if the authentication process is successful, the device information of the image forming apparatus 130 is acquired. Item 403 shows the acquired device information (for example, device name, IP address set for the device, etc.).

[0045] Figure 5 is a sequence diagram showing the sequence of operations when the operation instruction generation unit 302 of the device operation application 300 issues an operation instruction to the device operation IF service 203 of the image forming apparatus 130. When explaining Figure 5, the device operation application 300 is assumed to be the old application and the image forming apparatus 130 is assumed to be the old device, but the basic processing order of the authentication sequence is the same even with a new application and a new device.

[0046] In S500, the operation instruction generation unit 302 sends a request to the device operation IF service 203 to acquire a challenge value. Upon receiving the request to acquire a challenge value, the device operation IF service 203 sends a request to the authentication processing unit 204, which generates the challenge value (S501). In S502, the authentication processing unit 204 generates a challenge value and stores it in the memory of the image forming apparatus 130. The challenge value generated in S502 is sent back to the device operation IF service 203 in response (S503). Furthermore, the challenge value is sent back to the operation instruction generation unit 302 in response (S504).

[0047] In S505, the operation instruction generation unit 302, having acquired the challenge value, calculates (PWMD5+ch)×MD5 from the password entered in password input 401 and the acquired challenge value. At this time, the old application uses the general cryptographic provider 306, while the new application uses the FIPS cryptographic provider 305.

[0048] In S506, the operation instruction generation unit 302 transmits the authentication information 520 calculated in S505 to the device operation IF service 203, and also calls the API corresponding to the instructed operation from among the APIs provided by the device operation IF service 203.

[0049] In S507, authentication information 520 is passed to the authentication processing unit 204. Upon receiving the authentication information 520, the authentication processing unit 204 calculates (PWMD5+ch)×MD5(authentication information 521) in S508 from the password stored in the password storage unit 205 and the challenge value generated in S502. At this time, the old device uses the general encryption provider 208, while the new device uses either the FIPS encryption provider 207 or the general encryption provider 208 depending on the encryption method of the authentication information stored in the password storage unit 205. Details of the usage are shown in the block diagrams in Figures 7 to 10 and the flowchart in Figure 11.

[0050] In S509, the authentication information 520 and the calculated authentication information 521 are compared, and the authentication result (OK / NG) is determined based on whether they match. In S510, the challenge value stored in memory is discarded.

[0051] In S511, the authentication result from S509 is returned to the device operation IF service 203. If authentication is successful (if the authentication result is OK), the device operation IF service 203 requests the various operation processing units 209 to perform the instructed operation processing in S513. Since the operation processing varies, the specific details of the processing are omitted. In S514, once the operation processing is completed, the result is returned to the device operation IF service 203.

[0052] In S515, the device operation IF service 203 returns the result to the operation instruction generation unit 302.

[0053] If authentication fails (if the authentication result is NG), the device operation IF service 203 transmits the authentication result to the operation instruction generation unit 302 without requesting operation processing from the various operation processing units 209.

[0054] Figure 6 is a block diagram showing the authentication process in a combination of a device operation application 300 (old app) and an image forming apparatus 130 (old device). The step numbers in Figure 5 correspond to the step numbers in Figure 6.

[0055] The password storage unit 205 of the image system device 130 stores PWMD5(606), i.e., the MD5 hash value, in a TPM encrypted state under the "PWFolder" of the root folder.

[0056] The old application 601 installed on PC600 generates authentication information using the general cryptographic provider 306, as shown in S505. In S506, the old application 601 sends the authentication information (PWMD5+ch) × MD5 (610) to the device operation IF service 203.

[0057] Upon receiving the authentication information, the device operation interface service 203 passes the authentication information 610 to the authentication processing unit 204 in S507. Upon receiving the authentication information 610, the authentication processing unit 204 retrieves the password 606 stored in the password storage unit 205 in S508, generates authentication information 611 using the general cryptographic provider 208, and compares it with the received authentication information 610. The above is an overview of the authentication process using the old device and old application.

[0058] Let's consider the case where the PC600 and the image forming apparatus 130 are changed to FIPS mode. In order to comply with FIPS, the FIPS-compliant provider must execute processes S505 and S508 in Figure 6. However, simply replacing the provider will not enable authentication. This is because, even if the image forming apparatus 130 is changed to FIPS mode, the password stored in the password storage unit 205 remains PWMD5(606), so unless the password sent from the PC600 is encrypted using the MD5 hash method, the authentication information cannot be verified.

[0059] Therefore, we will explain how to migrate older devices and older applications to FIPS-compliant versions using Figures 7-10.

[0060] Figure 7 is a block diagram showing the authentication process in the combination of the new app and the new device. Note that the password storage unit 205 stores the same PWMD5(606) as the old device, using the same password method.

[0061] The new application 700 generates authentication information PW+ch(710) (S701). In S702, the new application 700 sends the authentication information PW+ch(710) to the device operation IF service 203.

[0062] Upon receiving the authentication information 710, the device operation IF service 203 passes the authentication information 710 to the authentication processing unit 204 in S703. Upon receiving the authentication information 710, the authentication processing unit 204 extracts the password (PW) from the received authentication information PW+ch(710) in S704. Using the general cryptographic provider 208 based on the extracted password, the authentication information (PWMD5+ch)×MD5(711) is generated.

[0063] In S705, the general encryption provider 208 retrieves the password 606 held by the password storage unit 205 and generates authentication information 712. The authentication processing unit 204 compares the authentication information 712 with the authentication information 711. If the comparison results in a match, in S706, the authentication processing unit 204 passes the PW extracted from the authentication information 710 to the password storage unit 205. Upon receiving the PW, the password storage unit 205 stores the password method 708, i.e., the new password method password, in a TPM encrypted state under the PWFolder of the root folder in S707. Meanwhile, the previous old password method PWMD5(606) is deleted. Through the process shown in Figure 7, a different encryption method (password method) is migrated from the old password method to the new password method, and authentication can be performed without using the MF5 encryption method in subsequent authentication processes. The authentication process at that time will be described later using Figure 8. The encryption method refers to the encryption algorithm applied to the authentication information, while the password method refers to the password method after the encryption algorithm has been applied to the password.

[0064] Figure 8 is a block diagram showing the authentication process up to the point of authentication determination for the combination of the new application and the new device (new password method). The new application 700 installed on the PC 600 generates authentication information PW+ch(710) in S701. In S702, the new application 700 sends the authentication information PW+ch(710) to the device operation IF service 203.

[0065] Upon receiving the authentication information 710, the device operation IF service 203 passes the authentication information 710 to the authentication processing unit 204 in S703. Upon receiving the authentication information 710, the authentication processing unit 204 retrieves the password 708 stored in the password storage unit 205 in S800, generates authentication information 810 by adding the challenge value ch, and performs the authentication process by comparing it with the authentication information 710. In the authentication process shown in Figure 8, the general cryptographic provider 208 using the MD5 encryption method is not used.

[0066] As described above in Example 1, even when migrating from an old device to a new device compatible with FIPS mode, the user can change the password method of the password stored in the image forming apparatus 130 simply by performing the usual authentication operation. [Examples]

[0067] In Example 2, we consider an environment where multiple applications use the device operation IF service 203, and where new and old applications coexist among these applications. In this case, it is possible that authentication requests may be sent from the old application before and after the transition to the new password method 708 shown in Figure 7. If the transition to the new password method is completed by the process in Figure 7, it will become impossible to process authentication requests from the old application. This example describes a process to address such a situation.

[0068] Figure 9 is a block diagram showing the authentication process up to the point of authentication determination for a combination of the old app and the new device (old password method). It shows the state up to the execution of the migration process to the new password method (Figure 7).

[0069] The root folder contains PWMD5(606), which is the MD5 hash value of the old password method, stored in a TPM-encrypted state under the PWFolder. The old application 601 is installed on PC600. This old application 601 uses the general encryption provider 306 to generate authentication information (S505).

[0070] In S506, the old application 601 sends authentication information (PWMD5+ch) × MD5 (610) to the device operation IF service 203. Upon receiving the authentication information, the device operation IF service 203 passes the authentication information 610 to the authentication processing unit 204 in S507. Upon receiving the authentication information 610, the authentication processing unit 204 retrieves the password 606 stored in the password storage unit 205 in S508, generates authentication information 611 using the general cryptographic provider 208, and performs authentication processing by comparing it with the received authentication information 610.

[0071] Figure 10 is a block diagram showing the authentication process in a combination of the old application and the new device (new password method). This is the state after the password method of the password stored in the password storage unit 205 has been switched to the new password method following successful authentication from the new application shown in Figure 7.

[0072] The old application 601 installed on PC600 generates authentication information in S505 using the general cryptographic provider 306. In S506, the old application 601 sends the authentication information (PWMD5+ch) × MD5 (610) to the device operation IF service 203.

[0073] Upon receiving the authentication information, the device operation IF service 203 passes the authentication information 610 to the authentication processing unit 204 in S507. Upon receiving the authentication information 610, the authentication processing unit 204 retrieves the password 708 stored in the password storage unit 205 in S1000 and generates authentication information 1010 using the FIPS cryptographic provider 207. At this time, because the FIPS cryptographic provider 207 is used, if the FIPS mode management unit indicates that FIPS mode is on, the generation of authentication information will fail, and thus authentication will fail. Therefore, when using the app in this old app × new device (new password method) state, it is necessary to turn off FIPS mode beforehand.

[0074] If authentication information 1010 can be generated, the authentication processing unit 204 compares it with the received authentication information 610 and makes an authentication decision.

[0075] The authentication flowcharts for the old and new apps and the new device, as shown in Example 1 and Example 2, are summarized in Figure 11.

[0076] Figure 11a shows a flow chart for determining whether to perform authentication processing corresponding to the old password method or the new password method, based on the password method of the password received from the device operation application 300.

[0077] When the authentication process starts in S1100, the device operation IF service 203 receives authentication information from the device operation application 300. In S1102, it is determined whether the received authentication information contains the challenge value ch. If it does, the device operation application 300 is determined to be a new application and proceeds to S1103. This is because the authentication information from a new application is PW+ch(710).

[0078] On the other hand, if it is determined that the received authentication information does not contain the challenge value ch, the device operation application 300 determines that it is an old application and proceeds to S1104. This is because the authentication information from an old application is (PWMD5 + ch) × MD5.

[0079] In S1103, the device operation IF service 203 passes authentication information to the authentication processing unit 204, which triggers the start of the process shown in Figure 11b.

[0080] Figure 11b shows the authentication process that the authentication processing unit 204 executes when the device operation IF service 203 determines in Figure 11a that it has received a password from the new application.

[0081] When the authentication process starts in S1110, the device operation IF service 203 receives the authentication information PW+ch(1) in S1111. In S1112, the password method of the password stored in the password storage unit 205 is checked. Specifically, the password method 708 is checked under PWFolder in the root folder. If the password method is the old password method 606, the process proceeds to S1113. The process from S1113 onwards corresponds to the process described in Figure 7. If the result of the determination in S1112 is that the password method is the new password method, the process proceeds to S1130. The process from S1130 onwards corresponds to the process described in Figure 8.

[0082] In S1113, if it is determined that the stored password is a PWMD5(5) encrypted by the TPM, PW(6) is extracted from PW+ch(1) in S1114. In S1115, the general cryptographic provider 208 is used to generate (PWMD5+ch)×MD5(7) from PW(6).

[0083] In S1116, PWMD5(5), which is encrypted by the TPM and stored in the password storage unit 205, is decrypted to obtain PWMD5(8). In S1117, (PWMD5+ch)×MD5(9) is generated from PWMD5(8) using the general encryption provider 208. In S1118, the authentication processing unit 204 compares the values ​​of (7) and (9). If they match, the process proceeds to S1119 and authentication is determined to be OK. On the other hand, if they do not match in S1118, the process proceeds to S1120 and authentication is determined to be NG. If authentication is determined to be OK, at least a part of the functions provided by the image forming apparatus 130 becomes available via the device operation application 300. The same applies if authentication is determined to be OK as described later.

[0084] In S1121, PW(6) is encrypted using the TPM encryption method and stored. In S1122, the password storage unit 205 deletes PWMD5(5).

[0085] In S1112, if it is determined that the stored password method is PW, then in S1130, it is determined that the stored password is PW(2) encrypted with TPM.

[0086] In S1131, the TPM-encrypted PW(2) is decrypted to obtain PW(3). In S1132, PW+ch(4) is generated by adding the challenge value ch to PW(3). In S1133, the values ​​of (1) and (4) are compared. If they match, the process proceeds to S1134 and authentication is determined to be successful. On the other hand, if they do not match in S1133, the process proceeds to S1135 and authentication is determined to be unsuccessful. This concludes the explanation of Figure 10.

[0087] Figure 11c is a flowchart showing the authentication process in the authentication processing unit 204 when the device operation IF service 203 determines in Figure 11a that it has received a password from the old application.

[0088] When the authentication process is initiated in S1140, S1141 determines that the authentication information received from the old application is (PWMD5+ch)×MD5(10).

[0089] In S1142, the password method of the stored password is checked. The specific method of checking is as described in S1112. If the password method is the old password method 606, the process proceeds to S1143. The processing from S1143 onwards corresponds to the processing described in Figure 9. In S1143, if it is determined that the stored password is a PWMD5(15) encrypted by the TPM, in S1144, the PWMD5(15) is decrypted and PWMD5(16) is obtained.

[0090] In S1145, the general cryptographic provider 208 is used to generate (PWMD5+ch)×MD5(17) from PWMD5(16).

[0091] In S1146, the authentication processing unit 204 compares the values ​​of (10) and (17). If they match, the process proceeds to S1147 and authentication is determined to be OK. On the other hand, if they do not match in S1146, the process proceeds to S1148 and authentication is determined to be NG.

[0092] If, in S1142, it is determined that the password method of the stored password is the new password method 708, the process proceeds to S1150. The processing from S1150 onward corresponds to the flow described in Figure 10.

[0093] In S1150, if it is determined that the stored password is PW(11) encrypted by the TPM, in S1151, the TPM-encrypted PW(11) is decrypted and PW(12) is obtained.

[0094] In S1152, PWMD5(13) is generated from PW(12) using the FIPS cryptographic provider 207. At this time, since the FIPS cryptographic provider 207 is used, if the FIPS mode management unit indicates that FIPS mode is on, the MD5 hash cannot be used, and authentication will fail in S1154, which will be described later. For this reason, it is necessary to turn off FIPS mode beforehand.

[0095] In S1153, the FIPS cryptographic provider 207 is used to generate (PWMD5+ch)×MD5(14) from PWMD5(13). In S1154, (10) and (14) are compared. If they match, the process proceeds to S1147 and authentication is determined to be OK. In S1154, if they do not match, the process proceeds to S1148 and authentication is determined to be NG. This concludes the explanation of Figure 11.

[0096] Figure 12 is a block diagram that summarizes the authentication status of the entire system when upgrading from an old device to a new device.

[0097] Authentication from the old application A1203 to the old device 1200 is possible, as shown in S1210. Subsequently, in S1211, the old device 1200 is upgraded to the new device (old password method) 1201.

[0098] Authentication from the old application A1203 to the new device (old password method) 1201 is possible, as shown in S1212. This process has already been explained in Figure 9. Similarly, authentication from the old application B1205 to the new device (old password method) 1201 is possible, as shown in S1213.

[0099] In S1214, the old application A1203 is upgraded to the new application A1204. Authentication of the new device (old password method) 1201 from the new application A1204 is possible, as shown in S1215. If authentication is successful, the system switches to the new device (new password method) 1202, as shown in S1216. The details are explained in Figure 7.

[0100] Authentication from the new application A1204 to the new device (new password method) 1202 is possible, as shown in S1217. Further details are explained in Figure 8.

[0101] At this time, authentication from the old application B1205 to the new device (new password method) 1202 fails when the device FIPS mode is on, as shown in S1218. On the other hand, authentication is possible when the device FIPS mode is off. Details are explained in Figure 10. In other words, because the process in S1216 is executed, the first authentication attempt between the old application A1203 and the new device 1201 is successful, but subsequent authentication attempts with the old application A1203 will not succeed unless the FIPS mode of the new device 1202 is turned off.

[0102] In addition to the configuration in which S1216 is executed upon successful first authentication between the old application A and the new device 1201, it is also possible to configure the system so that S1216 is not executed for a certain period of time, or so that S1216 is not executed until the authentication process between the old application A1203 and the new device 1201 has been successful a certain number of times.

[0103] As described above, the method shown in Example 2 allows authentication of authentication information from the old application even after migrating to FIPS compliance, by switching the device's FIPS mode off, considering a mixed environment of old and new applications.

[0104] [Other examples] The object of the present invention can also be achieved by performing the following process: supplying a storage medium containing program code for software that realizes the functions of the above-described embodiment to a system or device, and having the computer (or CPU, MPU, etc.) of that system or device read the program code stored in the storage medium. In this case, the program code read from the storage medium itself realizes the functions of the above-described embodiment, and the program code and the storage medium containing the program code constitute the present invention. [Explanation of Symbols]

[0105] 130 Image forming apparatus 207 FIPS Cryptographic Providers 208 General Cryptographic Providers 304 FIPS Mode Management Unit

Claims

1. An information processing device that performs authentication processing using authentication information received from a terminal, A first authentication means that encrypts the first authentication information received from the terminal into a second authentication information, and performs a first authentication process using the second authentication information and pre-managed authentication information, It includes a second authentication means that performs a second authentication process different from the first authentication process, If the second authentication information is authenticated by the first authentication means, The first authentication information is managed so that it can be used by the second authentication means. The information processing device, which has FIPS mode enabled and has acquired the first authentication information after the second authentication information has been authenticated by the first authentication means, An information processing device characterized in that it authenticates authentication information received from the terminal using the second authentication means without using the first authentication means.

2. The information processing device that acquired the first authentication information after the second authentication information was authenticated by the first authentication means, The information processing apparatus according to claim 1, characterized in that it authenticates the authentication information received from the terminal by the second authentication means without using the first authentication means.

3. The information processing apparatus according to claim 1 or 2, further comprising an enabling means for enabling the FIPS mode.

4. The aforementioned FIPS mode is, The information processing apparatus according to claim 3, characterized in that it is a mode that prohibits the use of a specific encryption method.

5. The aforementioned specific encryption method includes the MD5 hashing method. The information processing apparatus according to claim 4, wherein the encryption method used to obtain the second authentication information from the first authentication information is the MD5 hash method.

6. If the FIPS mode is not enabled by the activation means, The information processing apparatus according to any one of claims 3 to 5, characterized in that even after the second authentication information has been authenticated by the first authentication means, the authentication information received from the terminal is authenticated by the first authentication means.

7. If the FIPS mode is not enabled by the activation means, The information processing apparatus according to any one of claims 3 to 5, characterized in that, even after the second authentication information has been authenticated by the first authentication means, the authentication information received from the terminal is authenticated by the first authentication means without managing the first authentication information.

8. The aforementioned information processing apparatus is an image forming apparatus having at least a printing function, When the first authentication information is authenticated by the first authentication means or the second authentication means, The information processing apparatus according to any one of claims 1 to 7, characterized in that it provides at least a part of the functions of the image forming apparatus to the terminal that transmitted the first authentication information.

9. A control method for an information processing device that performs authentication processing using authentication information received from a terminal, A first authentication step involves encrypting the first authentication information received from the terminal into a second authentication information, and executing a first authentication process using the second authentication information and pre-managed authentication information. The system includes a second authentication step which performs a second authentication process different from the first authentication process, If the second authentication information is authenticated by the first authentication step, The first authentication information is managed so that it can be used by the second authentication step. The information processing device, which has FIPS mode enabled and has acquired the first authentication information after the second authentication information has been authenticated by the first authentication step, A control method for an information processing device, characterized in that authentication information received from the terminal is authenticated by the second authentication step without using the first authentication step.

10. A program for functioning as an information processing device that performs authentication processing using authentication information received from a terminal, A first authentication means that encrypts the first authentication information received from the terminal into a second authentication information, and performs a first authentication process using the second authentication information and pre-managed authentication information, It includes a second authentication means that performs a second authentication process different from the first authentication process, If the second authentication information is authenticated by the first authentication means, The first authentication information is managed so that it can be used by the second authentication means. The information processing device, which has FIPS mode enabled and has acquired the first authentication information after the second authentication information has been authenticated by the first authentication means, A program for causing an information processing device to function as such, characterized in that it authenticates authentication information received from the terminal using the second authentication means without using the first authentication means.

Images